Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

[Feature] Content-level governance boundary — PII detection, prompt injection defense, and cost budgets for Bot tool arguments

未關閉
  • 哪裡不對？
#86 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
30/100
Issue 類型
功能
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
typescript
領域
backend-api-design, security

研究方向

首先定位 issue 中描述的伺服器閘道管線，尤其是 CEL 評估之後、電腦呼叫之前的節點，並檢視現有的邊界外掛介面。比較建議的閘道外掛、邊界預設和代理程式中介軟體進入點；當確定一條整合路徑並定義其內容治理行為，且由適當的專案測試涵蓋時，這項工作就完成了。

由索引模型根據 Issue 內容生成。

描述

Problem

OpenBot's gateway handles infrastructure-level governance brilliantly — CEL policies on browser URLs, file paths, shell commands, and MCP tool classification. But there's a gap at the content level:

  1. PII in tool arguments — A Bot can pass an SSN, credit card number, or email to a tool without the gateway noticing, because CEL evaluates tool.name and page.url, not the argument content itself.

  2. Prompt injection via tool inputs — If a retrieved document or user message contains "ignore previous instructions...", that flows through the AG-UI endpoint into the Bot's tool arguments. The gateway sees a valid tool call to a permitted target — the adversarial content is invisible to CEL.

  3. Per-session cost budgets — The gateway records actions but doesn't enforce cumulative spend limits. A Bot can loop tool calls indefinitely without hitting a cost ceiling.

  4. Secret leakage in arguments — A Bot might pass api_key=sk-abc123... as a tool argument. The gateway correctly redacts secrets from the audit trail, but doesn't prevent the call from executing with the secret in-flight.

Proposed Solution

Add a content-level governance evaluator that runs alongside CEL, inspecting the content of tool arguments (not just tool names and targets). This would fire between "policy evaluated" and "call the computer" in the gateway pipeline.

One implementation: TealTiger — deterministic, in-process, no LLM in the evaluation path, <2ms per check. Already provides:

Check What It Catches
PII detection SSN, credit card, email, phone in tool args
Secret detection API keys, tokens, credentials
Prompt injection Instruction override, DAN, delimiter injection, system prompt override (8 patterns)
Cost budget Cumulative session spend with hard-stop
Argument validation SQL injection, path traversal in tool inputs

It could integrate as:

Option A — Gateway plugin:

// In the server gateway, after CEL evaluation, before calling computer
const contentDecision = await tealtigerEvaluate({
  toolName: resolvedTarget.tool,
  arguments: resolvedTarget.input,
  botId: bot.id,
  sessionCost: auditRow.cumulativeCost,
});
if (contentDecision.action === "DENY") {
  return refuse(contentDecision.reason);
}

Option B — Boundary preset:
A preset at /admin/boundaries that enables content-level checks:

# Content governance preset
name: "Content Protection"
rules:
  - scope: tool_arguments
    check: pii
    action: deny
    categories: [ssn, credit_card, email]
  - scope: tool_arguments
    check: prompt_injection
    action: deny
  - scope: session
    check: cost_budget
    action: deny
    max_usd: 5.00

Option C — Agent-level middleware:
The AG-UI agent (LangGraph, etc.) wraps itself with TealTiger middleware before registering as a Bot endpoint. Content governance happens inside the agent, infrastructure governance happens at the gateway. Defense-in-depth.

Use Cases
  • Financial services Bot handling account data — must not leak PII in tool arguments to third-party MCP servers
  • Research Bot consuming external documents — needs injection defense before those documents influence tool calls
  • Multi-Bot deployment with cost allocation — each Bot needs a per-session budget that hard-stops regardless of CEL rules
  • Compliance audit — need evidence that content-level checks were evaluated (not just that the URL/tool was permitted)
Why not just extend CEL?

CEL is great for structural checks (tool.name == "browser_navigate" && page.host != "internal.company.com"). But content scanning requires:

  • Regex pattern matching across variable-length text (PII/injection)
  • Stateful tracking (cumulative cost)
  • Confidence thresholds (injection detection isn't binary)

These are better served by a purpose-built content evaluator running alongside CEL rather than shoehorning them into CEL expressions.

Additional Context
  • TealTiger: https://github.com/agentguard-ai/tealtiger (Apache 2.0)
  • Already integrated with AG2 (built-in), Haystack, LangChain, CrewAI, Strands
  • NVIDIA Inception member
  • No external server required — runs in-process
  • Happy to contribute a PR once the boundary plugin interface stabilizes

This is complementary to existing governance, not a replacement. CEL handles infrastructure boundaries. Content evaluation handles what's inside the calls that pass those boundaries.

主要語言
TypeScript
星號
6.6k
分支
914
平均合併
23 小時 27 分鐘
30 天內合併 PR
136

環境準備

  • 提供 Dockerfile 或 Docker Compose 檔案
  • 有 Pull Request 範本
  • 沒有貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

CopilotKit/OpenBot 的其他 Issue

查看 CopilotKit/OpenBot 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。